The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses Python's subprocess.run to call git and oh-gc tools. The implementation uses list-based arguments without the shell, which follows security best practices to prevent command injection. Analysis of scripts/collect_pr_context.py and scripts/prepare_review_submission.py confirms that user-controlled strings are not interpreted by a shell.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data from pull requests, including diffs and comments, which constitutes a standard attack surface for review tools.
Ingestion points: scripts/collect_pr_context.py fetches PR view, diff, and comments directly into the local context.
Boundary markers: Not explicitly defined in the prompt interpolation, but structured via JSON artifacts.
Capability inventory: subprocess.run (calling oh-gc), file system writes to .review-gitcode-pr/, and file system reads of the local repository.
Sanitization: Relies on JSON structure; no explicit sanitization of comment bodies before display.
Mitigation: The skill implements a structured workflow with explicit checklists and human-in-the-loop confirmation for any external submissions, minimizing the risk that injected instructions could trigger unauthorized actions.
[DATA_EXFILTRATION]: The skill fetches PR data and posts comments to GitCode. This is the intended functionality of the skill. No unauthorized access to local sensitive files (e.g., SSH keys, credentials) or exfiltration to unknown domains was found.

review-gitcode-pr